Description
rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.
Metrics
CVSS 3.1 7.8/10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://seclists.org/fulldisclosure/2021/May/78Mailing List, Not Applicable, Third Party Advisory
- https://esnet-security.github.io/vulnerabilities/20190115_rsshExploit, Third Party Advisory
- https://github.com/WlX-33/PoC-for-CVE/blob/main/CVE-2021-33216%2CCVE-2019-1000018/CommScope%20Ruckus%20IoT%20Controller%201.7.1.0%20Undocumented%20Account.txt
- https://lists.debian.org/debian-lts-announce/2019/01/msg00027.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557/
- https://security.gentoo.org/glsa/202007-29Third Party Advisory
- https://usn.ubuntu.com/3946-1/Third Party Advisory
- https://www.debian.org/security/2019/dsa-4377Third Party Advisory
- http://seclists.org/fulldisclosure/2021/May/78Mailing List, Not Applicable, Third Party Advisory
- https://esnet-security.github.io/vulnerabilities/20190115_rsshExploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/01/msg00027.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557/
- https://security.gentoo.org/glsa/202007-29Third Party Advisory
- https://usn.ubuntu.com/3946-1/Third Party Advisory
- https://www.debian.org/security/2019/dsa-4377Third Party Advisory
Timeline
- Published
- Feb 4, 2019
- Last modified
- Jun 17, 2026
- NVD status
- Modified